Add SVG dataflow diagrams, extend trace coverage, and trace AI001 acr…

[akanthed]

…oss file boundaries

Renders every finding's source->flow->sink trace as an inline SVG node-link diagram in HTML reports instead of a flat text list. Extends dataflow tracing to MCP003, AI005, AI012, and VEC003, and teaches AI001 to follow tainted values across function/file boundaries (capped below proven evidence, cycle-safe). Also fixes AI012 never firing due to its own JSON.parse detection colliding with its ".parse(" validation-pattern check.

What and why

Detection logic changes (delete this section if not applicable)

• npm run regression was run and every proven/likely finding it printed was reviewed against its source line
• A new/updated rule has fixtures in both test-fixtures/vulnerable/ and test-fixtures/safe/
• src/scanner/catalog.ts and src/scanner/explainer.ts both have an entry for any new rule ID
• test/corpus.test.js's EXPECTED_VULNERABLE was updated for any new rule

CLI changes (delete this section if not applicable)

• test/cli.test.js has a new or updated case exercising the built binary (src/cli.ts changes aren't covered by any other test file)

Checklist

• npm run build && npm test passes
• Before/after behavior is described above, with a concrete example if the change affects scan output